New My Health Record Security and Access Policy template now available

September 23, 2026

The Office of the Australian Information Commissioner (OAIC), in partnership with the Australian Digital Health Agency (ADHA), has released an updated My Health Record Security and Access template to help healthcare provider organisations meet their obligations under the revised My Health Record Rules 2026. 

From 1 October 2026, all healthcare provider organisations registered with My Health Record must comply with the security and access policy requirements set out in rules 21 and 43 of My Health Record Rules 2026. These requirements replace security and access policy requirements previously set out in rule 42 of My Health Records Rules 2016.

The My Health Record Regulations 2026 and Rules 2026 commenced on 1 April 2026, updating and simplifying requirements for providers while maintaining existing privacy and security protections. 

Important reminders   

  • Existing participants (registered before 1 April 2026): transitional arrangements apply until 30 September 2026. Compliance with the new 2026 Rules after this date is mandatory.   
  • New participants (registered on or after 1 April 2026): must comply with the 2026 Rules.   

All organisations accessing My Health Record must maintain:   

  • auditable user account logs   
  • Security and Access Policy with annual reviews and supporting evidence   
  • staff training and record-keeping documentation   
  • cyber security awareness and data breach management processes. 

Further information and resources

Please reach out to SEMPHN’s Digital Health team via email – digitalhealth@semphn.org.au or call our team on (03) 8514 4460 if you have any further questions. 

Revised Security and Access policy requirements for healthcare provider organisations My Health Record participation obligations - Download the ADHA policy template

Latest news

Rubella and congenital rubella are now urgent notifiable conditions

October 29, 2026
From 28 October 2026, rubella and congenital rubella will change from being ‘routine’ to ‘urgent’ notifiable conditions in Victoria under the Public Health and Wellbeing Regulations 2019.

Advance notice: Tender opportunity for two new Medicare Mental Health Centres

October 27, 2026
South Eastern Melbourne Primary Health Network (SEMPHN) is providing advance notice of an upcoming open tender opportunity to establish and deliver two new Medicare Mental Health Centres in Cranbourne and Glen Iris.

Small practice, big achievement: Fernbank achieves non-traditional practice accreditation

October 21, 2026
Mornington Peninsula-based practice Fernbank has become the first non-traditional general practice in south east Melbourne to achieve accreditation – an important milestone for a two-person practice delivering care entirely within residential aged care homes.